Information Notice Regarding The Processing Of Personal Data
This Information Notice has been prepared by Op. Dr. Vahit MUTLU Clinic to inform the relevant parties about the processing of their personal data by the Clinic within the scope of the Law No. 6698 on the Protection of Personal Data (“KVKK”).
- Definitions
- Explicit Consent: Consent given regarding a specific issue, based on information and expressed freely.
- Anonymization: The process of making personal data impossible to associate with an identified or identifiable natural person, even by matching it with other data.
- Data Subject: The natural person whose personal data is processed.
- Personal Data: Any information relating to an identified or identifiable natural person.
- Sensitive Personal Data: Personal data relating to a person’s race, ethnic origin, political opinion, philosophical beliefs, religion, sect, or other beliefs, appearance, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.
- Processing of Personal Data: Any operation performed on personal data, whether or not by automated means, such as collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or prevention of use.
- Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller.
- Data Recording System: The recording system where personal data is processed according to certain criteria.
- Data Controller: The natural or legal person who determines the purposes and means of processing personal data, and who is responsible for establishing and managing the data recording system.
- Data Controller
Asst. Prof. Dr. Vahit MUTLU Clinic attaches great importance to the security of your personal data and takes the utmost care to process and protect your personal data as best as possible. With this awareness, your personal data is processed within the framework of the law and related regulations, as the data controller, in the manner described below.
- Collection, Processing, and Purposes of Processing Personal Data
We obtain your personal data through verbal, written, visual, or electronic means via call centers, the internet, social media applications, physical environments, and similar channels, depending on the nature of the service provided, to offer you services of high standards. In this context, your general and special categories of personal data, particularly the personal health data necessary for conducting all medical diagnosis, examination, treatment, and care services, are processed for the following purposes:
- Identity Data: Your name, surname, Turkish ID number, passport number, or temporary Turkish ID number, place and date of birth, marital status, gender, insurance or patient protocol number, and other identity data that can identify you.
- Contact Data: Your address, telephone number, email address, and other contact data.
- Customer Transaction Data: Your data, including invoices, receipts, and similar documents.
- Physical Space Security Data: Your CCTV images and sound recordings.
- Visual and Auditory Data: Your pre- and post-treatment/operation visual records.
- Health Data: Your laboratory and test results, examination data, appointment information, prescription information, and other data related to medical diagnosis, treatment, and care services, or resulting from these services, including but not limited to your health and sexual life data.
Your personal data may be processed within the scope of the conditions for processing personal data stipulated in Articles 5 and 6 of the Law for the following purposes:
- Conducting the patient’s medical diagnosis, treatment, and care services,
- Protecting public health, preventive medicine, conducting medical diagnosis, treatment, and care services,
- Sharing information requested by the Ministry of Health and other public institutions and organizations in accordance with the relevant legislation,
- Planning and managing health services and their financing,
- Conducting human resources processes, ensuring corporate communication,
- Ensuring the security of the Clinic,
- Collecting and recording the entry and exit data of employees and visitors,
- Planning and executing the Clinic’s audit activities, monitoring finance and/or accounting transactions, and managing relationships with business partners and/or affiliates,
- Monitoring patient requests and/or complaints,
- Ensuring that the Clinic’s activities are carried out in accordance with clinical procedures and/or relevant legislation,
- Planning and/or executing occupational health and/or safety processes,
- Conducting statistical studies,
- Fulfilling tasks and transactions resulting from signed contracts and protocols,
- Ensuring compliance with legal obligations required or mandated by legal regulations,
- Communicating with natural and legal persons who have a business relationship with the Clinic,
- Fulfilling legal reporting obligations,
- Managing call center processes,
- Fulfilling the burden of proof obligation in case of future legal disputes,
- Conducting and/or following up the Clinic’s legal transactions.
- Transfer of Personal Data
Your personal data may be transferred within the framework of the purposes outlined above and the relevant legislation, including but not limited to the Health Services Basic Law No. 3359, the Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliates, the Law No. 6698 on the Protection of Personal Data, the Regulation on the Processing and Protection of the Privacy of Personal Health Data, and the regulations of the Ministry of Health:
- The Ministry of Health, its sub-units, and family health centers,
- Private insurance companies (for health, retirement, life insurance, etc.),
- The Social Security Institution,
- The General Directorate of Security and other law enforcement agencies,
- The General Directorate of Population and Citizenship Affairs,
- The Turkish Pharmacists’ Association,
- Judicial authorities,
- Laboratories, medical centers, ambulance services, medical devices, and institutions that provide healthcare services, both in Turkey and abroad, with which we cooperate for medical diagnosis and treatment,
- The health institution to which the patient is referred or the one the patient applies to,
- Your authorized legal representatives,
- Our consultants including lawyers, tax advisors, and auditors,
- Regulatory and supervisory institutions and official authorities,
- Your employer,
- Our suppliers, service providers, archive service providers, and business partners with whom we cooperate or whose services we benefit from (you can obtain more detailed information by applying in writing to our clinic).
- Method and Legal Basis for Collecting Personal Data
Your personal data is collected and processed through any verbal, written, visual, or electronic means, within the framework of the purposes listed above and to carry out any work within the legal scope of the Clinic’s business and to fully and properly fulfill the contractual and legal obligations of the data controller. The legal basis for collecting your personal data includes:
- Law No. 6698 on the Protection of Personal Data,
- The Health Services Basic Law No. 3359,
- Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliates,
- The Regulation on the Processing and Protection of the Privacy of Personal Health Data,
- The regulations of the Ministry of Health and other relevant legislation.
Additionally, as stated in Article 6, paragraph 3 of the Law, personal data relating to health and sexual life may be processed without seeking the explicit consent of the data subject, by persons under confidentiality obligation or by authorized institutions and organizations, solely for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment, and care services, as well as planning and managing health services and their financing.
- Rights of the Data Subject
Regarding the processing of your personal data, you have the following rights under the relevant legislation by applying to us:
- To learn whether your personal data has been processed,
- To request information if your personal data has been processed,
- To learn the purpose of processing your personal data and whether they are used in accordance with the purpose,
- To know the third parties to whom your personal data is transferred, either domestically or abroad,
- To request the correction of your personal data if it is incomplete or incorrectly processed,
- To request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the KVKK (considering that the right to deletion under the Regulation on Personal Health Data may be evaluated based on the obligation to retain personal data in the scope of health),
- To request the notification of the correction, deletion, or destruction process to the third parties to whom your personal data has been transferred (considering that the right to deletion under the Regulation on Personal Health Data may be evaluated based on the obligation to retain personal data in the scope of health),
- To object to the processing of your personal data by automated means, which produces results to your detriment,
- To request the compensation of the damage if you suffer damage due to unlawful processing of your personal data.
If you exercise your rights to inquire whether your personal data has been processed, request information about your processed personal data, access your personal data, or request your data, learn the purpose of processing your personal data and whether they are used in accordance with the purpose, and to know the third parties to whom your personal data is transferred, either domestically or abroad, the information you requested will be provided to you in writing or electronically.
- Deletion, Destruction, or Anonymization of Personal Data
According to Article 7 of the Law, although your personal data may have been processed in accordance with the relevant legislation, if the reasons requiring its processing no longer exist, your personal data will be deleted, destroyed, or anonymized by our Clinic, either ex officio or upon your request. The procedures and principles regarding this matter will be carried out in accordance with the Regulation on the Deletion, Destruction, or Anonymization of Personal Data, published in the Official Gazette dated 28.10.2017 and numbered 30224.
- Contact Information
You may submit your requests related to your rights to us, in accordance with Article 13 of the Law No. 6698 on the Protection of Personal Data, in writing or through other methods determined by the Personal Data Protection Board.
Address: Küçükbakkalköy, Vedat Günyol Cd. No:28-30, 34750 Ataşehir/İstanbul
Phone: +90 530 211 44 32
Email: info@vahitmutlu.com.tr
